In the states this is handled by the FFIEC but there is no specific complexity requirement. In accordance with the rest of the guidelines the complexity require

In the states this is handled by the FFIEC but there is no specific complexity requirement. In accordance with the rest of the guidelines the complexity requirements are supposed to be based on a risk assessment.